The brute-force that worked
The Linux server web01 was hit by an SSH brute-force attack on 2026-03-10. Work the auth.log: measure the attack, identify the account that fell, and find the backdoor the attacker left behind.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`grep -c 'Failed password'` counts the brute-force attempts.
The `Accepted password` line names the account that fell; `new user` names the backdoor.
Solution explanation
You reconstructed the whole intrusion from one file: 48 failed guesses, a successful login as svc-backup, a sudo to root, and a hidden UID-0 account named support left for re-entry. Counting, field-extraction with awk, and pattern search with grep are most of day-one SOC work.
Show solution
cd /home/student
grep -c 'Failed password' /srv/soc-data/linux/auth.log
grep -F 'Accepted password' /srv/soc-data/linux/auth.log
grep -E 'sudo|new user' /srv/soc-data/linux/auth.log
printf 'attacker=203.0.113.66\nuser=svc-backup\nbackdoor=support\n' > /home/student/auth-report.txt